month report
September 2026
Data as of Sep 7, 2026, 05:00 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →
September 2026 closed with 2,011 published CVEs — -56.9% YoY . 170 criticals, 8 added to CISA KEV. linux led volume, mostly via linux. Biggest breakout: elastic at ×6.0 their 12-month median. Top weakness class — CWE-79 (174 CVE). 10 vendors cracked the top-100 for the first time.
Projected total
7,541
-41.6% MoM+61.7% YoY· proj
Severity mix
170 / 606
critical / high
KEV added
8
0 ransomware-linked
Nuclei coverage
0.2%
4 CVEs with templates
Time to exploit
How fast the community ships detection after a CVE drops.
Days → Nuclei (median)
2.6
n=1
Within 7 days
100.0%
Within 30 days
100.0%
Days → KEV (median)
1
n=3
Detection gap
KEV pressure, no Nuclei coverage
September 2026 · vendors with active exploitation listed by CISA but no public detection template.
- KEV 1google38 CVE
Weakness × Vendor
What's spreading where in September 2026
Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.
79XSS862Missing Authorization89SQL Injection639Auth Bypass via User Key863Incorrect Authorization22Path Traversal74Injection918SSRF284CWE-28478OS Command Injectionlinuxhewlett packard enterprise (hpe)4164158ibm11128623dell13216arubanetworks316126red hat121115elastic7125google27ash-project1411mozilla12jenkins project471321nvidia1
Most discussed CVEs — September 2026
- CVE-2026-83548KEV9×10.0
- CVE-2026-83549KEV9×7.8
- CVE-2026-82329KEV7×9.8
- CVE-2026-85046KEV7×8.8
- CVE-2026-9586KEV7×9.8
- CVE-2026-11645KEV5×8.8
- CVE-2026-2441KEV5×8.8
- CVE-2026-3909KEV5×8.8
- CVE-2026-3910KEV5×8.8
- CVE-2026-5281KEV5×8.8
- CVE-2026-629115×8.0
- CVE-2026-862065×
- CVE-2026-862075×
- CVE-2026-862185×
- CVE-2026-07684×9.8
- CVE-2026-15409KEV4×10.0
- CVE-2026-15410KEV4×7.2
- CVE-2026-64714×7.2
- CVE-2026-672764×
- CVE-2026-672774×
- CVE-2026-860604×
- CVE-2021-318863×9.8
- CVE-2025-3248KEV3×9.8
- CVE-2026-07693×9.8
Breakout vendors
CVE count ≥3× their own 12-period median.
- 6.0×elastic42 CVE
- 5.7×hpe86 CVE
- 3.1×arubanetworks52 CVE
- 3.0×jenkins33 CVE
First time in top-100
Vendors never in top-100 in the prior 24 periods.
- #13ash-project24 CVE
- #17themoos18 CVE
- #21moos-ivp15 CVE
- #22@xmldom15 CVE
- #23xmldom15 CVE
- #29yeswiki12 CVE
- #32undici11 CVE
- #40passmark software8 CVE
- #41pjsip8 CVE
- #43xmlsoft8 CVE
Top vendors
Ranked by distinct CVE count this period.
- 188 CVE1 critCVSS 8.0linux (188)
- 86 CVE6 critCVSS 7.0×5.7fabric composer (52) · aos-cx (34) · arubaos-cx (29)
- 70 CVE2 critCVSS 6.1i (22) · langflow oss (17) · integration bus for z/os (9)
- 52 CVE5 critCVSS 6.7×3.1fabric composer (52)
- 42 CVECVSS 5.8×6.0kibana (30) · elasticsearch (4) · elastic cloud on kubernetes (2)
- 38 CVE10 critCVSS 7.3KEV 1chrome (38)
- 34 CVE12 critCVSS 7.7thunderbird (31) · firefox (29) · firefox mobile (3)
- 33 CVECVSS 6.5×3.0jenkins (13) · jenkins pipeline: build step plugin (2) · jenkins script security plugin (2)
- 33 CVE1 critCVSS 6.4red hat enterprise linux 8 (27) · red hat enterprise linux 9 (27) · red hat enterprise linux 7 (26)
- 30 CVECVSS 7.8megatron bridge (30) · nemo megatron bridge (30)
- 28 CVE5 critCVSS 7.1avideo (28)
- 26 CVE1 critCVSS 5.5gammu sms daemon (3) · screenshot (2) · commerce paypal (1)
- 24 CVENEWash (17) · ash_typescript (7)
- 19 CVE1 critCVSS 8.5powerstore 3000t (13) · powerstore 3200q (13) · powerstore 3200t (13)
- 18 CVEmediatek chipset (18)
- 18 CVECVSS 7.8rslinx classic® (4) · dataedgeplatform datamosaix™ private cloud (2) · factorytalk® historian machine edition (2)
- 18 CVE5 critCVSS 8.1NEWcore-moos (12) · essential-moos (5) · ui-moos (1)
- 17 CVECVSS 6.3sales and inventory system (10) · online medicine delivery system (5) · school management system (1)
- 16 CVEotp (16)
- 15 CVECVSS 6.3doctor appointment system (3) · hospital information system (3) · hotel and tourism reservation in php (2)
- 15 CVE6 critCVSS 8.2NEWmoos-ivp (15)
- 15 CVENEWxmldom (15)
- 15 CVENEWxmldom (15)
- 14 CVE1 critCVSS 6.6cms (14)
- 14 CVEmisp (14)
- 14 CVECVSS 7.3class and exam timetabling system (10) · online voting system (4)
- 13 CVE1 critCVSS 6.9siyuan (13)
- 12 CVECVSS 6.4grav (5) · grav-plugin-api (3) · grav-plugin-form (2)
- 12 CVE1 critCVSS 7.4NEWNuclei 2yeswiki (12)
- 11 CVE3 critCVSS 8.4PoC 11cisco ios xr software (7) · cisco secure email (2) · cisco nx-os software (1)
- 11 CVE8 critCVSS 8.9cp3 (6) · hg10 (5)
- 11 CVECVSS 5.8NEWundici (11)
- 10 CVECVSS 5.2c driver (4) · c++ driver (2) · libmongocrypt (2)
- 9 CVEcurl (9)
- 9 CVE4 critCVSS 8.9azure ai language authoring (1) · azure cosmos db (1) · entra (1)
- 9 CVEn8n (9)
- 9 CVEpnpm (2) · @openclaw/feishu (2) · @tiptap/core (1)
- 9 CVECVSS 7.7rancher (5) · yast2-users (1) · fleet (1)
- 8 CVECVSS 6.5apache allura (4) · apache skywalking (2) · apache griffin hive metastore module (1)
- 8 CVECVSS 7.3NEWburnintest (8) · osforensics (8) · performancetest (8)
- 8 CVENEWpjproject (8)
- 8 CVECVSS 4.5phpmyfaq (8)
- 8 CVECVSS 5.9NEWlibxml2 (8)
- 7 CVEeclipse aerios (3) · eclipse arrowhead (2) · eclipse ditto (2)
- 7 CVECVSS 7.6nginx javascript (3) · big-ip (2) · big-iq (1)
- 7 CVECVSS 6.6NEWnebula-mesh (7)
- 7 CVECVSS 6.7librenms (7)
- 7 CVECVSS 5.7NEWhermes-agent (7)
- 7 CVECVSS 7.4NEWnuclio (7)
- 7 CVECVSS 7.6NEWopenpanel (7)
| # | Vendor | CVEs | Crit | KEV | Nuclei | Signals | Top products | Δ | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | linux | 188 | 1 | · | · | linux (188) | — | ||
| 2 | hpe | 86 | 6 | · | · | ×5.7 | fabric composer (52) · aos-cx (34) · arubaos-cx (29) | — | |
| 3 | ibm | 70 | 2 | · | · | i (22) · langflow oss (17) · integration bus for z/os (9) | — | ||
| 4 | arubanetworks | 52 | 5 | · | · | ×3.1 | fabric composer (52) | — | |
| 5 | elastic | 42 | · | · | · | ×6.0 | kibana (30) · elasticsearch (4) · elastic cloud on kubernetes (2) | — | |
| 6 | 38 | 10 | 1 | · | KEV 1 | chrome (38) | — | ||
| 7 | mozilla | 34 | 12 | · | · | thunderbird (31) · firefox (29) · firefox mobile (3) | — | ||
| 8 | jenkins | 33 | · | · | · | ×3.0 | jenkins (13) · jenkins pipeline: build step plugin (2) · jenkins script security plugin (2) | — | |
| 9 | redhat | 33 | 1 | · | · | red hat enterprise linux 8 (27) · red hat enterprise linux 9 (27) · red hat enterprise linux 7 (26) | — | ||
| 10 | nvidia | 30 | · | · | · | megatron bridge (30) · nemo megatron bridge (30) | — | ||
| 11 | wwbn | 28 | 5 | · | · | avideo (28) | — | ||
| 12 | drupal | 26 | 1 | · | · | gammu sms daemon (3) · screenshot (2) · commerce paypal (1) | — | ||
| 13 | ash-project | 24 | · | · | · | NEW | ash (17) · ash_typescript (7) | — | |
| 14 | dell | 19 | 1 | · | · | powerstore 3000t (13) · powerstore 3200q (13) · powerstore 3200t (13) | — | ||
| 15 | mediatek, inc. | 18 | · | · | · | mediatek chipset (18) | — | ||
| 16 | rockwell automation | 18 | · | · | · | rslinx classic® (4) · dataedgeplatform datamosaix™ private cloud (2) · factorytalk® historian machine edition (2) | — | ||
| 17 | themoos | 18 | 5 | · | · | NEW | core-moos (12) · essential-moos (5) · ui-moos (1) | — | |
| 18 | itsourcecode | 17 | · | · | · | sales and inventory system (10) · online medicine delivery system (5) · school management system (1) | — | ||
| 19 | erlang | 16 | · | · | · | otp (16) | — | ||
| 20 | code-projects | 15 | · | · | · | doctor appointment system (3) · hospital information system (3) · hotel and tourism reservation in php (2) | — | ||
| 21 | moos-ivp | 15 | 6 | · | · | NEW | moos-ivp (15) | — | |
| 22 | @xmldom | 15 | · | · | · | NEW | xmldom (15) | — | |
| 23 | xmldom | 15 | · | · | · | NEW | xmldom (15) | — | |
| 24 | craftcms | 14 | 1 | · | · | cms (14) | — | ||
| 25 | misp | 14 | · | · | · | misp (14) | — | ||
| 26 | sourcecodester | 14 | · | · | · | class and exam timetabling system (10) · online voting system (4) | — | ||
| 27 | siyuan-note | 13 | 1 | · | · | siyuan (13) | — | ||
| 28 | getgrav | 12 | · | · | · | grav (5) · grav-plugin-api (3) · grav-plugin-form (2) | — | ||
| 29 | yeswiki | 12 | 1 | · | 2 | NEWNuclei 2 | yeswiki (12) | — | |
| 30 | cisco | 11 | 3 | · | · | PoC 11 | cisco ios xr software (7) · cisco secure email (2) · cisco nx-os software (1) | — | |
| 31 | tenda | 11 | 8 | · | · | cp3 (6) · hg10 (5) | — | ||
| 32 | undici | 11 | · | · | · | NEW | undici (11) | — | |
| 33 | mongodb | 10 | · | · | · | c driver (4) · c++ driver (2) · libmongocrypt (2) | — | ||
| 34 | curl | 9 | · | · | · | curl (9) | — | ||
| 35 | microsoft | 9 | 4 | · | · | azure ai language authoring (1) · azure cosmos db (1) · entra (1) | — | ||
| 36 | n8n-io | 9 | · | · | · | n8n (9) | — | ||
| 37 | npm | 9 | · | · | · | pnpm (2) · @openclaw/feishu (2) · @tiptap/core (1) | — | ||
| 38 | suse | 9 | · | · | · | rancher (5) · yast2-users (1) · fleet (1) | — | ||
| 39 | apache software foundation | 8 | · | · | · | apache allura (4) · apache skywalking (2) · apache griffin hive metastore module (1) | — | ||
| 40 | passmark software | 8 | · | · | · | NEW | burnintest (8) · osforensics (8) · performancetest (8) | — | |
| 41 | pjsip | 8 | · | · | · | NEW | pjproject (8) | — | |
| 42 | thorsten | 8 | · | · | · | phpmyfaq (8) | — | ||
| 43 | xmlsoft | 8 | · | · | · | NEW | libxml2 (8) | — | |
| 44 | eclipse foundation | 7 | · | · | · | eclipse aerios (3) · eclipse arrowhead (2) · eclipse ditto (2) | — | ||
| 45 | f5 | 7 | · | · | · | nginx javascript (3) · big-ip (2) · big-iq (1) | — | ||
| 46 | forgekeep | 7 | · | · | · | NEW | nebula-mesh (7) | — | |
| 47 | librenms | 7 | · | · | · | librenms (7) | — | ||
| 48 | nousresearch | 7 | · | · | · | NEW | hermes-agent (7) | — | |
| 49 | nuclio | 7 | · | · | · | NEW | nuclio (7) | — | |
| 50 | openpanel-dev | 7 | · | · | · | NEW | openpanel (7) | — |
Sectors
Solution categories ranked by distinct CVE count this period.
- Web & CMS Plugins299 CVE25 crit127 vendorsCVSS 7.3yeswiki (12) · class and exam timetabling system (10) · grav (5)
- Operating Systems248 CVE2 crit7 vendorsCVSS 8.0linux (188) · red hat enterprise linux 8 (27) · red hat enterprise linux 9 (27)
- OSS Libraries200 CVE2 crit53 vendorsCVSS 7.5langflow oss (17) · otp (16) · curl (9)
- Hardware Firmware159 CVE28 crit13 vendorsCVSS 8.6fabric composer (52) · ethernet/ip adapter development kit (eadk) (1) · ethernet/ip adapter development kit with cip security (eadk-secure) (1)
- Networking Infrastructure128 CVE34 crit8 KEV26 vendorsCVSS 8.5fabric composer (52) · cisco ios xr software (7) · cp3 (6)
- Enterprise Software126 CVE2 crit39 vendorsCVSS 7.1sales and inventory system (10) · integration bus for z/os (9) · librenms (7)
- Consumer Software99 CVE22 crit1 KEV13 vendorsCVSS 7.5chrome (38) · firefox (29)
- Databases67 CVE11 vendorsCVSS 7.6kibana (30) · c driver (4) · elasticsearch (4)
- Cloud & SaaS65 CVE5 crit25 vendorsCVSS 9.8n8n (9) · nuclio (7) · red hat openshift container platform 4 (7)
- DevTools & CI53 CVE8 vendorsCVSS 6.6jenkins (13) · rancher (5) · red hat ansible automation platform 2 (3)
- Communications48 CVE11 crit7 vendorsCVSS 7.7thunderbird (31) · openlist (1)
- ICS / OT / IoT42 CVE1 crit16 vendorsCVSS 7.7rslinx classic® (4) · factorytalk® historian machine edition (2) · netbotz 5 - 750/755 (2)
- AI / ML40 CVE7 crit25 vendorsCVSS 7.6hermes-agent (7) · cowagent (2) · label-studio (2)
- Security Products36 CVE2 crit19 vendorsCVSS 8.3misp (14) · boruta-server (2) · checkmate (1)
- Mobile Apps2 CVE2 vendorsCVSS 6.5heym (1) · smart connect application (1)
- Unclassified23 CVE3 crit13 vendorsCVSS 6.8pocketmine-mp (5) · blinko (2) · note-mark (2)
| Sector | CVEs | Crit | KEV | Vendors | Products | Avg CVSS | Top products |
|---|---|---|---|---|---|---|---|
| Web & CMS Plugins▸ 6 | 299 | 25 | · | 127 | 169 | 7.3 | yeswiki (12) · class and exam timetabling system (10) · grav (5) |
| Operating Systems▸ 2 | 248 | 2 | · | 7 | 22 | 8.0 | linux (188) · red hat enterprise linux 8 (27) · red hat enterprise linux 9 (27) |
| OSS Libraries▸ 5 | 200 | 2 | · | 53 | 80 | 7.5 | langflow oss (17) · otp (16) · curl (9) |
| Hardware Firmware▸ 4 | 159 | 28 | · | 13 | 64 | 8.6 | fabric composer (52) · ethernet/ip adapter development kit (eadk) (1) · ethernet/ip adapter development kit with cip security (eadk-secure) (1) |
| Networking Infrastructure▸ 4 | 128 | 34 | 8 | 26 | 37 | 8.5 | fabric composer (52) · cisco ios xr software (7) · cp3 (6) |
| Enterprise Software▸ 7 | 126 | 2 | · | 39 | 57 | 7.1 | sales and inventory system (10) · integration bus for z/os (9) · librenms (7) |
| Consumer Software▸ 4 | 99 | 22 | 1 | 13 | 15 | 7.5 | chrome (38) · firefox (29) |
| Databases▸ 5 | 67 | · | · | 11 | 25 | 7.6 | kibana (30) · c driver (4) · elasticsearch (4) |
| Cloud & SaaS▸ 5 | 65 | 5 | · | 25 | 38 | 9.8 | n8n (9) · nuclio (7) · red hat openshift container platform 4 (7) |
| DevTools & CI▸ 3 | 53 | · | · | 8 | 27 | 6.6 | jenkins (13) · rancher (5) · red hat ansible automation platform 2 (3) |
| Communications▸ 3 | 48 | 11 | · | 7 | 9 | 7.7 | thunderbird (31) · openlist (1) |
| ICS / OT / IoT▸ 4 | 42 | 1 | · | 16 | 36 | 7.7 | rslinx classic® (4) · factorytalk® historian machine edition (2) · netbotz 5 - 750/755 (2) |
| AI / ML▸ 4 | 40 | 7 | · | 25 | 28 | 7.6 | hermes-agent (7) · cowagent (2) · label-studio (2) |
| Security Products▸ 5 | 36 | 2 | · | 19 | 23 | 8.3 | misp (14) · boruta-server (2) · checkmate (1) |
| Mobile Apps▸ 1 | 2 | · | · | 2 | 2 | 6.5 | heym (1) · smart connect application (1) |
| Unclassified | 23 | 3 | · | 13 | 18 | 6.8 | pocketmine-mp (5) · blinko (2) · note-mark (2) |
Weakness × Sector
Which weaknesses hit which solution categories in September 2026
Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.
79XSS862Missing Authorization89SQL Injection639Auth Bypass via User Key863Incorrect Authorization22Path Traversal74Injection918SSRF284CWE-28478OS Command InjectionWeb & CMS Plugins88464717117281251Operating Systems11122111OSS Libraries8111016362Enterprise Software11132697522655Hardware Firmware41852510Networking Infrastructure71127523322Consumer Software443732DevTools & CI813864322Databases72113512Cloud & SaaS251134429